Lead security incidents from detection and triage through containment, eradication, recovery, and post-incident review.Coordinate incident response across Security, SRE, Engineering, Legal, and leadership while communicating status, impact, and risk.Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, cloud log